Skip to main content

Table 1 A summary of the variables applied in the SNAD framework.

From: Specializing network analysis to detect anomalous insider actions

Variable

Description

S = {s1, s2, . . . , s m }

The set of subjects in the CIS.

U = {u1, u2, . . . , u n }

The set of users in the CIS.

u j → s i

An access of user u j to subject s i .

U s i

The set of users that access subject s i .

N e t s i

A complete graph of U s i .

SU

A binary matrix of subjects and users, the size of which is m × n. If u i accesses s j , SU(j, i) = 1, else SU(j, i) = 0.

U i

A column vector of access history of u i on all subjects. U i = SU[:, i].

SU_IDF

A matrix with the same size as SU. Each cell value of SU_IDF corresponds to its inverse document frequency (IDF) transformation.

B = [1, 1, . . . , 1]

A vector of 1's of length m.

IDF_U i

A column vector of access history of u i on all subjects. IDF_U i = SU_IDF[:, i].

PC'

A matrix created from SU or SU_IDF, the size of which is l × n, where l is the number of selected principal components.

λ k

The kth eigenvalue

λ total

The sum of the l eigenvalues.

λPC'

A matrix created from PC', where λPC'[k, :] = (λ k /λ total ) × PC'[k, :].

C i

A column vector of u i on the selected l principal components. C i = λPC'[:, i].